Skip to content

LUKS Encryption Management

fparted integrates Linux Unified Key Setup (LUKS) support via cryptsetup, enabling creation, mapping, unlocking, and locking of hardware-encrypted block devices on rooted Android.

🔒 Formatting Encrypted Containers

The Encrypt Partition dialog executes FormatLuksOperation with enterprise cryptographic options:

Target Partition:    /dev/block/sda1
LUKS Version:        LUKS2 (Default) or LUKS1
Cipher:              aes-xts-plain64
Key Size:            512-bit (AES-256 in XTS mode)
Hash Algorithm:      sha256 / sha512
Sector Size:         4096 bytes (4K native alignment)
Inner Filesystem:    ext4 / btrfs / f2fs

sequenceDiagram
    participant App as fparted
    participant Crypt as cryptsetup
    participant Kernel as Linux dm-crypt

    App->>Crypt: luksFormat --type luks2 --cipher aes-xts-plain64 ...
    Crypt->>Crypt: Derive keys via Argon2 / PBKDF2
    Crypt-->>App: LUKS header written
    App->>Crypt: open --type luks2 /dev/block/sda1 fparted_tmp_crypt
    Crypt->>Kernel: Create /dev/mapper/fparted_tmp_crypt
    App->>App: mkfs.ext4 /dev/mapper/fparted_tmp_crypt
    App->>Crypt: close fparted_tmp_crypt
    Crypt->>Kernel: Teardown temporary mapper

🔓 Unlocking & Mapping Containers

The Unlock Partition dialog executes OpenLuksOperation: - Accepts user passphrase via secure stdin pipe (never exposed on command-line arguments). - Maps device node to /dev/mapper/<custom_mapper_name>. - Allows read-only unlocking via --readonly.

🔐 Locking Mapped Devices

The Lock Partition action executes CloseLuksOperation: - Flushes pending dirty pages through dm-crypt. - Destroys the plaintext device mapper node via cryptsetup close <mapper_name>.